A vulnerability in PHP — the programming language running roughly 70% of the world's websites — went from public disclosure to millions of exploitation attempts in under 24 hours. The flaw, dubbed PHP2Shell, allows attackers to seize control of web servers, steal data, and hijack computing resources. Cloudflare's CEO Matthew Prince reported tens of thousands of exploit attempts within 45 minutes of announcement, rising to hundreds of thousands within two hours, then millions. The speed of weaponization is the headline, but the structural story runs deeper. The vulnerability itself had been present in PHP for decades. Research firm Wiz, which helped uncover the flaw, called it "arguably among the most severe software vulnerabilities ever discovered" and noted that demonstrating its exploitability required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." The critical accelerant: frontier AI models substantially reduced that barrier, turning a longstanding flaw into a practical exploit. This is a signal worth tracking — AI is compressing the timeline between vulnerability discovery and weaponization. Governments moved fast. The NSA warned the flaw could allow attackers to seize control of web servers, steal sensitive data, and move deeper into networks. South Korea activated emergency response measures and issued guidance to tens of thousands of companies. China's industry ministry urged immediate system inspection and upgrades. Japan's prime minister told organizations to patch or shut down. In the UK, 32 government services were taken offline as a precaution, and cybersecurity minister Liz Lloyd confirmed no public-facing critical services were compromised. But the response asymmetry is the real vulnerability. Large governments and corporations have cybersecurity teams that can patch within hours. Schools, local governments, charities, and small businesses do not. Ciaran Martin, former head of the UK's National Cyber Security Centre, called it "the most serious vulnerability discovered for five years." The organizations least equipped to respond are the ones most likely to remain exposed. The exploitation model is also worth understanding. Michał Woźniak, an internet infrastructure expert, explained that hostile actors could "nest" themselves into exposed sites and exploit their computing power, IP addresses, and server resources. Criminal groups could launch attacks from hijacked IP addresses that can't be traced back. Crypto miners could run energy-intensive calculations for free. Many compromised sites may never know they've been taken over. There are also questions about disclosure handling. Cloudflare observed thousands of exploit attempts in the 10 hours before the vulnerability was publicly announced, suggesting the flaw was known in attacker circles before the patch was ready. Cybersecurity expert Prof Alan Woodward noted the flaw was revealed a day before the patch was released — "somebody let the cat out of the bag." The gap between disclosure and patch availability is a systemic problem in coordinated vulnerability disclosure. Ryan Austin of cybersecurity firm Calif, key to discovering the flaw, offered a counterpoint: "At the moment it doesn't look like exploitation has taken off or been widespread." Amazon Threat Intelligence, however, confirmed PHP2Shell was "now being broadly exploited in the wild" with multiple actors testing exploits before the patch dropped. The contradiction suggests that large-scale compromise may be underway but not yet visible — particularly among organizations without monitoring capability.
